Compliance Stuff

Many employers are surprised to discover that sponsoring a company health plan can trigger full HIPAA compliance obligations. Even if you are not a hospital or insurance company, y our self-funded health plan may qualify as a “covered entity” under the Health Insurance Portability and Accountability Act . That can create potential legal exposure for both you, as the employer, and for your Third Party Administrator. What is a self-funded health plan? In a self-funded health plan, the employer takes on the financial risk of paying employee medical claims directly, rather than paying fixed premiums to an insurance carrier . Funds typically come from a dedicated trust or general company assets, with claims paid as they arise. Employers often choose this model for greater control over benefits design, potential cost savings (especially for larger groups), and better access to claims data for wellness initiatives. Key HIPAA trigger : Under federal rules , a group health plan, including self-...

Easiest to-do list ever! As I reported recently , the U.S. Equal Employment Opportunity Commission has rescinded a detailed harassment guidance document issued during the Biden Administration. As a result, many employers are probably wondering what exactly they can and cannot do, as well as what they should and shouldn’t do. I  speculated  about this in early January. Now that the rescission is official, here is my 2026 harassment to-do list for employers. I hope it helps. No. 1: If you have a good harassment policy, don’t change a thing.  Well, maybe one or two things, discussed below. But don't believe the hype. The EEOC's action does not mean that we're in a harassment free-for-all. Don't delete the parts of your policy that prohibit discrimination or harassment based on sexual orientation and gender identity. You should keep those. The U.S. Supreme Court  ruled in 2020  that discrimination (and, presumably, harassment) based on sexual orientation or gender i...

What is it with universities in "M" states these days? Last week, it was the University of Michigan.  Now, it’s the University of Mississippi. A federal judge in Mississippi  ruled recently  that a race discrimination lawsuit filed by a former employee of Ole Miss will go to trial. The only surprise here is that the University even thought it had a shot at summary judgment. (My guess is that this was a "desperation" motion.) Here’s what happened. The school was hiring an intervention specialist for a student substance abuse program. Apparently most of those served by the program were white, fratty kids. Solo cup abuse? Our plaintiff (we’ll call her Dolores), a Black female, was one of three candidates for the intervention specialist position. She alleged that during her job interview, her future boss (we’ll call her Natalie) told Dolores that she really hoped to have a white male in the position. Natalie, who like Dolores is a Black female, denies having said this, ...

On January 21, the day after President Trump designated Andrea Lucas as Acting Chair of the Equal Employment Opportunity Commission, the Commission issued a press release describing Ms. Lucas’s priorities as including the following: Rooting out unlawful DEI-motivated race and sex discrimination ; protecting American workers from anti-American national origin discrimination; defending the biological and binary reality of sex and related rights, including women’s rights to single sex spaces at work; protecting workers from religious bias and harassment, including antisemitism; and remedying other areas of recent under-enforcement. Implementing these priorities was stymied for most of 2025 due to the absence of a quorum at the five-person Commission. But on October 7, the Senate confirmed Republican Brittany Panuccio as the third EEOC Commissioner. Yahtzee! That makes a quorum. And now President Trump has removed the “Acting” designation and named Ms. Lucas as Chair of the EEOC . Double Y...

According to the source of all knowledge – Google – individual liability exists when a person (like you) is legally responsible for his or her own conduct, debts, or obligations. That means y our individual bank account and other assets could be seized if your actions, or failures to act, violate the law and cause injury to others. Normally, a corporate employer is liable for the wrongs committed against employees by individuals acting on the employer’s behalf. That typically includes the company’s owners, managers, and supervisors. But did you know that many federal and state employment laws also subject owners of businesses, along with their managers and supervisors, to individual liability? Included among these laws are the Fair Labor Standards Act, the Family and Medical Leave Act, the Civil Rights Act of 1991, and numerous state employment discrimination and wage protection laws. These exposures are not limited to your affirmative misconduct. They can include lesser conduct like a...

The recent shutdown of the federal government has left many critical services in limbo, including the nation’s primary cybersecurity agency. Amid the ongoing budget standoff in Congress, funding for the Cybersecurity and Infrastructure Security Agency lapsed, coinciding with the expiration of the  Cybersecurity Information Sharing Act of 2015 . The expiration of the Act creates operational and legal uncertainty for organizations at a time when cyberattacks are at an all-time high. The law had long provided liability protection for companies that shared cyber threat information in good faith, establishing a legal framework for public-private defense collaboration. Role of CISA Before the Act took effect in 2015, companies that alerted federal partners or peers about cyber incidents risked violating privacy, contract, and competition laws. The Act was designed to remove those disincentives and encourage information sharing by providing the following: Liability protections:   Shi...

Two years ago, the long dormant duty to accommodate employees’ religious beliefs and practices was awakened by the U.S. Supreme Court in  Groff v. Dejoy . Gone were the days when an employer could justify the denial of a religious accommodation by showing that it would have had more than a  de minimis  impact on the business . Many religious organizations (rightfully) lamented that this resulted in the routine denial of most accommodation requests. Groff  eviscerated that standard. According to the Supreme Court, the denial of a religious accommodation requires proof that it would have caused “substantial increased costs in relation to the conduct of [the employer’s] particular business .” As the Supreme Court often does, it provided few details about the meaning of that requirement . Leaving them instead to be developed by the lower federal courts, on a case-by-case basis. Now, with two years of hindsight, that development is beginning to take shape. The good news: ...